Email & DNS
Mail routing, filtering gateways and DMARC posture reveal more about a school's IT maturity than its website does — and here the picture is uneven.
Microsoft runs the mailrooms
Microsoft 365 is the near-universal mail platform. Nine of the domains route mail into Microsoft — sometimes directly (Lancaster, Surrey, Aston, U-Maths), sometimes behind a security gateway. Two schools instead use Google Workspace: Liverpool and (pre-opening) Durham. King's is the odd one out with no independent mail domain at all — its school addresses live on King's College London's central estate.
Two email-security gateways recur. Barracuda's Email Security Service filters mail for Cambridge, Leeds and 1729 (and Lancaster reports to Barracuda too); an older UK filtering service, MailAnyone / mx25.net, front-ends Exeter and Imperial. These gateways sit in front of the actual mailbox provider and scan inbound mail.
The DMARC scorecard
DMARC tells the world what to do with mail that fails authentication — i.e. mail that spoofs the school's domain. It's a plain read of security hygiene, and the network splits three ways.
| School | DMARC policy | Mail provider / gateway |
|---|---|---|
| Lancaster (LUSoM) | p=reject | Microsoft 365 |
| Durham | p=reject | Google Workspace |
| 1729 | p=reject | Microsoft 365 + Google / Barracuda Email Security Service |
| Imperial | p=quarantine | Microsoft 365 / MailAnyone |
| U-Maths | p=quarantine | Microsoft 365 |
| Exeter | p=none | MailAnyone / mx25.net / MailAnyone |
| Liverpool | p=none | Google Workspace |
| Cambridge | p=none | Microsoft 365 / Barracuda Email Security Service |
| Surrey | p=none | Microsoft 365 |
| Leeds (LMaS) | no DMARC | Microsoft 365 + Google / Barracuda Email Security Service |
| Aston | no DMARC | Microsoft 365 |
| KCL | n/a | King's College London (central) |
| Nottingham | n/a | None configured |
Just Lancaster, Durham and 1729 publish an enforcing p=reject. Two more quarantine. The rest publish a monitor-only p=none or no DMARC record at all — meaning a spoofed "from the school" email would sail through. Notably, U-Maths reports its DMARC data into the NCSC's free Mail Check service (dmarc.service.gov.uk), the UK government's email-security tool — a nice touch even at only quarantine strength.
Who holds the domains
The six .ac.uk domains are all registered through Jisc (the academic-network registry) — though the agent varies: Lancaster manages its own, Leeds's is handled by the indie host Mythic Beasts, the rest via Jisc directly. The commercial domains scatter across GoDaddy (Surrey, Nottingham), 123-Reg (King's, Durham), IONOS (Cambridge), Netistrar (Liverpool) and UK2 (1729). For DNS hosting, GoDaddy's domaincontrol.com nameservers are the most common, with Jisc, Cloudflare, Krystal, IONOS and Lancaster University's own servers also in the mix.
One small tell of longevity: Liverpool registered its .org for a full twelve years, out to 2032 — unusually far ahead for a school.